Quantum tomographic cryptography with Bell diagonal states: non-equivalence of 

classical and quantum distillation protocols 



O 

o 

00 



> 
00 

oo 

o 

00 

o 
o 

Oh: 



X 



Dagomir Kaszlikowski,^ Jenn Yang, Lim/ D. K. L. Oi,^ Frederick 

H. Willeboordse,^ Ajay Gopinathan,'^' ^ and L. C. Kwek'^^^ 

'Department of Physics, National University of Singapore, Singapore 117542, Singapore 
^Centre for Quantum Computation, Department of Applied Mathematics and Theoretical Physics, 

University of Cambridge, Cambridge CB3 OWA, U.K. 
'^National Institute of Education, Nanyang Technological University, Singapore 639 798, Singapore 

We present a generalized tomographic quantum key distribution protocol in which the two parties 
share a Bell diagonal mixed state of two qubits. We show that if an eavesdropper performs a 
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key distillation are less effective than quantum entanglement distillation protocols. We also show 
that certain Bell diagonal states are resistant to any attempt of incoherent eavesdropping. 
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INTRODUCTION 

The security of quantum key distribution (QKD) P,0 
is an important consequence of the application of the laws 
of physics to information and communication theory. A 
one-time pad provides perfect cryptographic security for 
sending messages between two parties but relies on being 
able to distribute a shared secret key 0,0. Classically, it 
is impossible to amplify a set of shared randomness, but 
quantum mechanics allows this to be done by the trans- 
mission of quantum states . The full power of quantum 
cryptography rests on the ability to place upper bounds 
on the knowledge of a potential eavesdropper (Eve) about 
the distributed key shared by the legitimate parties (Al- 
ice and Bob). In this paper we present a generalization of 
the so-called tomographic quantum key distribution pro- 
tocol Jij] . We consider the situation where Alice and Bob 
use qubits in a maximally entangled state distributed by 
a central source. The qubits undergo a quantum channel 
that converts the state to a Bell diagonal mixed state. 

We analyze the security of this protocol under two 
broad scenarios. In the first scenario, Alice and Bob 
agree on a cryptographic key if the correlations between 
their measurement results are stronger than any possi- 
ble correlations between one of them and Eve, under the 
assumption that Eve has full control over the source of 
entangled qubits but she can only perform incoherent 
measurements. The tomographic element of the protocol 
allows Alice and Bob to compute the maximal strength 
of correlations between Eve and any one of them. The 
Csiszar-Korner theorem then guarantees that if the 
correlations between Alice and Bob are stronger than 
those between Eve and either of them, a secure key can 
be established through one-way error correcting codes. 

In the second scenario, we examine the situation when 
Eve's correlations are initially stronger than Alice and 
Bob's. It was shown that in some cases it is still possible 
to obtain a secure key [sf. The idea is that by means of 



two-way communication Alice and Bob can strengthen 
their correlations with respect to Eve's so that the CK 
theorem can be applied again. This procedure is called 
advantage distillation (AD). 

There are two possible strategies for Eve within the 
second scenario: incoherent and coherent measurements. 
The first case was examined in [loj where it was shown 
that advantage distillation is possible as long as the two- 
qubit state shared by Alice and Bob is entangled. We 
re-derive this result using different reasoning than the 
one presented in [lo| . 

In the second case, we show that the above result no 
longer holds in the case of coherent measurements by 
Eve. Indeed, if the qubits are affected by too many errors 
(caused by Eve's actions), advantage distillation fails de- 
spite Alice and Bob still sharing an entangled state. In 
such cases the only way for Alice and Bob to obtain a 
secure key is to revert to quantum entanglement distilla- 
tion. 



TOMOGRAPHIC QKD 

In a tomographic QKD scheme, a central source dis- 
tributes entangled qubits to Alice and Bob. They inde- 
pendently and randomly choose to measure three tomo- 
graphically complete observables Ux, ly and ct^ (Pauli 
matrices) on each qubit. At the end of the transmission, 
they publicly announce their choice of observables for 
each qubit pair. They then proceed to divide their mea- 
surement results according to those for which their mea- 
surement bases match, and those for which their mea- 
surement bases do not match. Exchanging a subset of 
their measurements allows Alice and Bob to tomograph- 
ically reconstruct the density operator of the two-qubit 
state they share. 

Ideally, in the absence of noise in the source or chan- 
nels, they expect to receive the maximally entangled state 
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where \zk) is the eigenstate of Gz with the eigenvalue 
(— l)*^, and Ahce (Bob) possesses the left (right) qubit. 
The results for matching bases can then be used to gen- 
erate a cryptographic key as they are either perfectly 
correlated ( for x and z bases) or anti-correlated (for y 
basis) . 

However, Alice and Bob cannot realistically expect to 
obtain the maximally entangled state Eq. because ei- 
ther the source is not ideal, the channel conveying the 
qubits is noisy, or there is an eavesdropper tampering 
with the source. For security analysis, we assume that 
Eve has total control over the source and that all the 
errors are caused by her when she tries to extract infor- 
mation about the key. 

To constrain Eve's information, Alice and Bob use part 
of their measurements to perform full tomography on the 
state distributed by the source. The protocol we consider 
here is such that Alice and Bob agree to communicate if 
and only if they see the Bell diagonal state 
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and y~! ^ >. n Pn.h = l,t<^ = —1- Following the nomencla- 
ture of we call a the amplitude bit and b the phase 
bit. Here, we assume that poo > 5 0- 

The above state can be obtained from the maximally 
entangled state Eq. ^ assuming that the travelling 
qubits undergo bit and phase flips. The so-called Werner 
state, i.e., the maximally entangled state with white 
noise, is a special case where poi = pio = pu. There- 
fore, the protocol presented here is more general than 
the one studied in 0, ^| where only Werner states were 
considered. 

As Alice and Bob perform their measurements in the 
three bases x,y and z, it is convenient to express the 
state Qab in the x and y bases. This can easily be done 
using the transformation rules on the Bell states, 
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Writing out (O in the other bases, we have 
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-6+l|2/ah)(2/afc|- (5) 



We can then compute the probability of Alice and Bob 
obtaining correlated results conditional on a particular 
choice of basis: 



Prob(correlation|a; basis) ~ Poo+Pii 
Prob(correlation|?/ basis) = Poi + Pw 
Prob(correlation|z basis) — poo + pn, 



(6) 



and also the probability of getting anti-correlated results: 

Prob(anti-correlation|a; basis) = Poi+Pio 
Prob(anti-correlation|y basis) = Poo + Pii 
Prob(anti-correlation|z basis) = Poi+Pia- (7) 

Since poo > Alice and Bob are more likely to ob- 
tain correlated results when they measure in the x and 
z bases, and anti-correlated results in the y basis; Alice 
and Bob will thus make use of correlation to generate 
their key when they measure in the x and z bases, and 
anti-correlation to generate their key when in the y basis. 



EAVESDROPPING 

In order to obtain as much information as possible 
about the key generated by Alice and Bob, Eve entangles 
their qubits with ancilla states \eab) in her possession. 
The best she can do is to prepare the following tripartite 
pure state 



\iPaBe) = ^ VPo^\^ab)\eab), 



(8) 



a, 6=0 



where {eab\ecd) = Sa^cSb,d- Tracing out Eve gives the 
mixed state Eq. |j2J) that Alice and Bob measures, and 
this purification is the most general one as far as inco- 
herent attacks are concerned. 

Eve's purifications, when expressed in different bases, 
read 
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We can express Eq. @ more conveniently as 



state of her ancilla, 
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where 
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and the normaUzed kets 
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V ^'^ b=0 

(12) 

are such that their inner products are given by 

/ fz I fz \ _ PaO ^ Pal _ xz 
\JOa\Jla) — = 



(/oal/la) 
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PaO + Pal 
POa - Pla ^ 
POa + Pla 
PO a+1 - Pla 
PO a+1 +Pla 



(13) 



The anciUas with different a's are orthogonal. 

Eve's eavesdropping strategy proceeds as follows. Af- 
ter Alice and Bob announce their measurement bases, 
Eve knows on which pairs of qubits they measured the 
same observables and that her ancilla is a mixture of 
four possible states. Formally this can be viewed as a 
transmission of information from Alice and Bob to Eve 
encoded in the quantum state of Eve's ancilla. To find 
the optimal eavesdropping strategy, she has to maximize 
this information transfer by a choice of a suitable gener- 
alized measurement known as a Positive Operator Value 
Measure (POVM). For example, if Alice and Bob mea- 
sured in the x basis, Eve will obtain the following mixed 
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fc.a=0 



This is equivalent to Alice and Bob "communicating" to 
Eve that they measured {00,01,10,11} by sending her 
the quantum states {|/oo) J/oi), l/n) J/fo)} with prior 
probabilities {^,^,^,^} respectively. Eve has to 
find the optimal measurement that will extract from the 
transmission as much information as possible, called the 
accessible information. Note that this is not equivalent 
to finding a measurement that minimizes the error of dis- 
tinguishing between these states [l5| . 



INCOHERENT ATTACK 

We first assume that Eve carries out an incoherent at- 
tack in which she performs measurements on her ancillas 
one at a time. In contrast, in a coherent attack, she 
would measure joint observables of more than one an- 
cilla, or construct her initial state Eq. ((HJ so that more 
than one pair of qubits were entangled with each ancilla. 

The ancilla states for each basis can be divided into 
two groups. The first group corresponds to a = and 
refers to the case when Alice and Bob obtain correlated 
results. The second group corresponds to the case a = 1 
and refers to the case when Alice and Bob obtain anti- 
correlated results. 

For example, if Alice and Bob both measure in the y 
basis, Eve will have the state 
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The first group a = occurs with probability tq and the 
second group a = 1 occurs with probability ri . Similarly, 
if they measure in the x (z) basis, the first group occurs 
with probability qo (po) while the second group occurs 
with probability qi (pi). The ancillas in the first group 
l/fco) ("^ ~ 2/' orthogonal to those in the second 

group Ifll). 

For the purpose of applying the Csiszar-Korner theo- 
rem, we need only to compute the mutual information 
between Eve and Bob and compare this with the mutual 
information between Alice and Bob; Eve would have to 
optimize her measurements on her ancilla so that it max- 
imizes the information she gains about Bob's measure- 
ment results. 

Let us now present the POVM measurement that max- 
imizes the information transferred by Bob to Eve. In the 
first step. Eve sorts the mixture of the ancillas into two 
sub-ensembles according to the index a. This can easily 
be done using a projective measurement. This sorting is 
an auxiliary step as, at this stage, she does not gain any 
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more information about the result of Bob's measurement. 
After that, depending on the outcome of the projection 
(a = or a = 1), Eve has an equiprobable mixture of 
two non-orthogonal ancilla states each corresponding to 
Alice and Bob's result. For example, if the chosen mea- 
surement basis was the z basis, Eve will receive the mixed 
state 



Bob is given by 



Iab = l--iH{po) + H{qo) + H{ro)). (21) 



k,a=0 



Projecting into either the a = or a = 1 orthogonal 
subspaces (depending on Alice and Bob's measurement 
outcomes), she will obtain one of the two equiprobable 
mixtures of non-orthogonal ancilla states 
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2 l/oi)(/oil 
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We are interested in the conditions for which our pro- 
tocol is secure against Eve's incoherent eavesdropping at- 
tack. Now, even if Eve obtains some information about 
the transmitted key through her incoherent measure- 
(1*5) ment, Alice and Bob can still obtain a secure key with a 
few additional steps. According to the Csiszar-Korner 
(CK) theorem, a secure key can be generated from a 
raw key sequence by means of a suitably chosen error- 
correcting code and classical one-way communication be- 
tween Alice and Bob if the mutual information between 
Alice and Bob exceeds that between Eve and either one 
if Alice and Bob obtained '^^ them (the CK regime). For the protocol considered, 

the mutual information between Alice and Eve, and Bob 
correlated results, a = 0; ^nd Eve, are the same so that security is assured as long 

if Alice and Bob obtained 

anti-correlated results, a = 1. /^^ > Ig^. (22) 

(17) 



Next, she applies the measurement that maximizes the 
accessible information encoded in the mixture of the two 
ancilla states given by the outcome of her projective mea- 
surement. In the case of two equally likely states, this 
optimum measurement is given by the so-called square- 
root measurement |l,l[ Il4j. The outcome probabilities of 
the square-root measurement are 
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= ; 1 



(18) 



where ry™ is the probability of correctly inferring a given 
ancilla state in the m basis (m = x,y,z). The index 
a refers to the correlation/anti-correlation subspace in 
which the ancilla lies. 

It is straightforward to compute the mutual informa- 
tion between Bob and Eve: 
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is the mutual information when Alice and Bob 
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where / 



BE 



measure in the same basis 



We have 



^BE — 
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^BE ^ 
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qo(l-if(ryo"))+gi(l-i/(ry^)) 
ro(l-i/(%^))+ri(l-iJ(77^)) 

Po(l-i?(%^))+Pi(l-i?(^D) 



(20) 



Here, i?(?7™ 



the binary entropy of the respective probability distribu- 
tions. Also, the mutual information between Alice and 



QUANTUM ENTANGLEMENT DISTILLATION 

If there is too much noise in the two-qubit state, the 
CK theorem is not immediately applicable. Instead, Al- 
ice and Bob need to either select a subsequence of their 
bit values in a systematic way or pre-process their two- 
qubit state before measuring, so that the CK theorem is 
applicable once more. One method of doing this is quan- 
tum entanglement distillation (QED), a quantum proce- 
dure by which many weakly entangled qubit pairs are 
distilled into a smaller number of more strongly entan- 
gled qubit pairs by means of local operations and classical 
communication. 

Alice and Bob's two-qubit state Eq. Q can be distilled 
successfully using local operations and classical commu- 
nication as long as they satisfy the Peres-Horodecki par- 
tial transposition criterion |l7l |: A two-qubit state g is 
quantum distillable if and only if it is a non-positive 
partial transposed (NPPT) state. A state g is NPPT 
if g'^^ ^ so that it has at least one negative eigen- 
value. Here, g^'^ denotes the transposition with respect 
to Bob's basis only. The partial transpose of each of our 
Bell states gives. 
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Applying the Peres-Horodecki criterion to our Bell di- 
agonal mixture, we find that the state Eq. ^ is quantum 
distillable provided that 



maxpab > 

ah 



(24) 
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ADVANTAGE DISTILLATION 



approximately 



Instead of manipulating their qubits in QED, Alice and 
Bob can process the raw key sequence they have estab- 
lished in the protocol in order to obtain a more secure 
key sequence. One such procedure is known as advantage 
distillation (AD). 

In the AD protocol, Alice and Bob divide their raw key 
sequence into blocks of length L. For each block, Alice 
generates a random bit and adds this, modulo 2, to each 
bit of the block. She then sends this processed block to 
Bob via a public channel. After receiving the block, Bob 
subtracts his corresponding block from it (modulo 2). If 
all the bit values are the same, it is a deemed a good 
block. Otherwise it is a bad block. Bob then informs 
Alice whether the block he received was good or bad. If 
it is a good block, Alice will record the random bit she 
initially generated into her distilled bit sequence while 
Bob enters into his distilled sequence the common bit 
value he found after subtraction. If it is a bad block, 
they will both reject the bits and it plays no further part 
in the distillation procedure. 

Now for a good block, two cases can occur: 

(I) Alice and Bob's distilled bits are the same; 

(II) Alice and Bob's distilled bits are different. 

Case (I) occurs when Alice and Bob started out with an 
identical raw block (i.e. their length L blocks are perfectly 
correlated). On the other hand, Case (II) occurs when 
Alice and Bob start out with raw L-blocks that are anti- 
correlated with each other. 

Now, for large L, there will be approximately ^ bits 
in the good block that result from Alice and Bob's 
z basis measurement. For these, po is the probabil- 
ity that Alice and Bob obtain correlated results while 
Pi is the probability that they obtain anti-correlated 
results. Similarly, ^ bits will result from x [y) ba- 
sis measurement - (ro) is the probability that Al- 
ice and Bob obtain correlated results while q\ (ri) is 
the probability that they obtain anti-correlated results. 
Thus for a good block. Case (I) occurs with probabil- 

L/3 L/3 L/3 

ity I./3 L?3, 1/3 L/3 L/3 whllc Case (II) occurs with 
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probability 



L/3 L/3 L/3 
Pi ■?! 
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Pa la - 



L/3 L/3 L/3 

-Pi q- ~ 



(remember that for 



the y basis, Alice and Bob generate their raw key from 
anti-correlation, which corresponds to probability ri). 
The error rate for Alice and Bob (the proportion of Case 
(II) blocks) is given by 



Eab = 



L/3 L/3 L/3 

Pi Qi ^0 



L/3 L/3 L/3 L/3 L/3 L/3- 



(25) 
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/ Pi giro ' 
\Poqori J 



L/3 



(26) 



which for L ^ 1, pi < Po and qi < qo (since poo > i) is 



Eve is able to intercept the processed blocks that Alice 
sends to Bob via the classical channel. Prom their public 
communication, she will also be able to know which of 
the blocks are accepted or rejected. For the good blocks, 
she has to deduce the distilled bit for each block. To 
do this, she can either resort to incoherent or coherent 
measurements on her ancillas. 



Incoherent Attack on Advantage Distillation 

In the incoherent attack, Eve performs a square root 
measurement to distinguish her ancillas one by one and, 
from her results, tries to deduce what Alice and Bob mea- 
sured for each entry in an L-block. She then subtracts 
Alice's transmitted block from her own corresponding 
block, as Bob does. Typically, Eve's block will be inho- 
mogeneous after subtraction so she decides by majority 
voting which bit value to assign to a particular block - 
she bets on the value which occurs most frequently in her 
block, and if there are the same number of Os as Is, she 
picks one of them at random. 

Consider Case (I) blocks, i.e. Alice and Bob start out 

with correlated raw blocks. From her square-root mea- 
surement. Eve guesses each entry in the block correctly 
with the following probabilities: 

• r]Q if Alice and Bob measured in the x basis; 

• ryf if they measured in the y basis; 

• r]Q if they measured in the 2:-basis. 

She guesses an entry incorrectly with probabilities 

• 1 — r/o if Alice and Bob measured in the x basis; 

• 1 — r]i if they measured in the y basis; 

• 1 — r^o if ^^^y measured in the ^;-basis. 

Because Eve applies majority voting, she makes errors 
whenever she guesses more than half of the entries in a 
block wrongly. If the same number of Os and Is appear in 
her guesses, she picks one of them at random and makes 
errors half of the time. We can thus compute Eve's error 
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rate: 



E 



(I) _ 

BE — 
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X ( )(l-ryfr='(,7D^ 



(27) 



where is the number of errors made in the z*'' basis. 
The second summation arises from the situation when 
Eve has to assign or 1 at random to the block because 
the number of Os and Is in the block are equal. 

For L 3> 1, we can lower bound the summations in 
Eq. H27|) by approximating them with the main con- 
tributing terms, i.e., terms for which the binomial factor 

(m — X, y, z) has its peak: 



E 



ii) 

BE 



6 / 

x(|)(l-%^)^(%^)*. (28) 
By applying Stirling's approximation we have 

e\^1 ^ 2^ (77i?^^o(l - - '7D(1 - • (29) 

Similarly for Case (II) blocks in which Alice and Bob 
start out with anti-correlated raw blocks, we can obtain 
the error rate for Eve: 

4"^ - 2^ ivWoVtil ~ Vf){l - v'o)i^ - vt)V ■ (30) 
Finally, the total error rate for Eve is given by 
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(31) 



Since the coefficient in front of E^^ goes to 1 while 



the coefficient in front of E^j^' goes to 0, we are left with 
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By comparing the error rates [9|, we can obtain the 
condition for AD to be successful under an incoherent 
attack: 



fim 1^ < 1 

L^oo Ebe 



(33) 



which reduces to 



< sJvSvHil ~ %-)(l - r^y)il - rjl). (34) 
Pq 9o ri v 

For the special case of Werner states (poi = Pio = 
Pii = ^—§^, so that po = go = ri, = = tq and 
Vo ^ Vi = Vo)i we find that Eq. reduces to 



Po * 

A similar result was obtained by BruB et al. [l^ . 



(35) 



Coherent Attack on Advantage Distillation 

We consider a particularly simple scheme of coherent 
attack that is similar to that presented in Eve's 
strategy is as follows. 

For each good block, Eve has a corresponding set of 
ancilla states and rather than measuring her ancillas one- 
by-one (an incoherent attack), she performs a joint mea- 
surement on all L of them to acquire knowledge about 
the value that Alice assigned to the block. By also mak- 
ing use of the classical information that is exchanged be- 
tween Alice and Bob during the distillation process, Eve 
can learn a lot more than if she were to measure her 
ancillas one by one. 

Consider first a Case (I) block. As an example, sup- 
pose that Alice and Bob start out with the same block 
01001 for L = 5, and Alice's random bit is 1. After ad- 
dition (modulo 2), she sends the processed block 10110 
to Bob via the public channel which Eve is able to inter- 
cept. Eve can also project her block of ancilla states into 
the orthogonal subspace corresponding to Alice and Bob 
having a correlated or anti-correlated block. Doing this, 
she can know that Alice and Bob started out with the 
same raw blocks (i.e. Case (I) blocks). From this. Eve 
can then deduce the following possibilities: 

1. If Alice's random bit is '0', Alice and Bob must 
have started out with raw blocks 10110. If Alice 
and Bob had measured in the bases x, y, y, z, x for 
the respective entries in the block, the ancilla state 
that she holds wiU be |/fi)|/o'i)|/fo)l/n>l/oo>- 

2. If Alice's random bit is '1', Alice and Bob must have 
started out with raw blocks 01001. If x,y,y,z,x 
is the order of basis measurements for the en- 
tries, the ancilla state that she holds will then be 

l/.io^)l/l'o>l/o'i)l/o^o>l/fi>- 
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The mutual inner product between the two ancilla states 
is (Ag)"="(Aj')"!'(Ag)"% where Ua is the number of times 
the basis a was measured. The optimal measurement to 
distinguish these two states is again the square root mea- 
surement. In general, for each Case (I) block of length L, 
Eve needs to distinguish just 2 possible L-ancilla states 
with mutual inner product (Ag)"=" (Af (Ag)"^ . 

Now, for large L, we have nx,ny,nz « ^. Eve's prob- 
ability of correctly inferring a particular L-ancilla state 
is given by 



1 



1 



1 - (Ai^A^A^)^ 



1 



1 



(AgA^Ag)^. (36) 



Her error rate for Case (I) blocks is thus 



E 



(I) 

BE 



r(ASAfAg)^. 



(37) 



Similarly when we consider Case (II) blocks, Eve's er- 
ror rate is 



E 



ill) 
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BE ~ -^(K^oK) ^ 



(38) 



Eve's total error rate is thus 
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Pola'^i + Pi 11^0 
J(Ai5AfAg)^ 



(39) 



since once again, the coefficient in front of E^l^ goes to 
1 while the coefficient in front of E^j^ goes to 0. 

Finally by comparing error rates (Eq. H33|) ). we obtain 
the condition for AD to be possible under a coherent 
attack by Eve: 



n. ^ ^^.^,^.^2 

Po qo ri 



DISCUSSION 



(40) 



We now analyze the above results. A Bell diagonal 
density matrix is characterized by four real parameters 
and a normalization condition so we can parameterize 
such a state by the probability poo (the amount of the 
state I Zoo) in the Bell mixture) and two angles 9, <j} char- 
acterizing the remaining three probabilities PoiiPiOiPii^ 



Poi = (1 -_poo)cos^6'cos^' 
Pw = (1 - Poo) sin^ 9 cos^ (, 
Pii = (1 -poo)sin^0. 



(41) 



This means that for a fixed poO: all the quantities such as 
Iab, I be, Eab, Ebe for incoherent and coherent attacks 
are two-argument functions. 

First, for each poo we can plot a region character- 
izing all the Bell diagonal states which lead to secure 
raw keys. As long as poo is greater than around 0.765 
all corresponding states are secure. Below this, fewer 
and fewer states are secure (white regions in Fig. ^ 
until, for pqq ~ i, the Bell diagonal mixture becomes 
separable and no secret bits can be obtained. Even 
then we can still identify certain states that are resis- 
tant against incoherent eavesdropping as long as poo 
is greater than half. These are states of the form 
Pookoo)(^oo| + Poi\zoi){zoi\, Poo|2;oo)(2oo| +Pio|zio)(zio| 
and poo|zoo)(-2oo| + Pii l^ii) (^n |. It is interesting to note 
that this threshold of 0.765, below which it is no longer 
possible to generate secure keys for every state, is the 
same threshold as that for the Werner state — this means 
that the Werner state will be the first state to become 
insecure as the poo threshold is exceeded. 

Second, using Eq. we verified the results presented 
in ^3 1 namely that QED is equivalent to AD if Eve 
can only perform incoherent attacks. In other words, 
as long as poo is greater than i, Alice and Bob do not 
need QED because AD works equally well and does not 
require collective operations on qubits, which arc difficult 
to realize experimentally. 

However, if Eve is capable of carrying out a coherent 
attack, QED is much more powerful than AD (Fig. [SJ. 
We see that as poo ^ 5, more states fall into the black 
regions where AD fails and only QED is possible. As 
before, the same states that are resistant to incoherent 
attack in the CK regime are resistant to the above co- 
herent attack on AD. 



CONCLUSION 

We have generalized the tomographic QKD scheme to 
Bell diagonal states and analyzed its resistance to various 
eavesdropping attacks, both in the CK regime and when 
Alice and Bob perform advantage distillation. We have 
shown the inequivalence of advantage distillation and en- 
tanglement distillation in the presence of coherent mea- 
surement by a potential eavesdropper. It still remains to 
be seen whether Eve can further increase her information 
gain by entangling more than one pair of Alice and Bob's 
qubits with her ancilla. 
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CK Regime, poo = 0.58 



CK Regime, poo = 0.55 



CK Regime, poo = 0.51 
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FIG. 1: Comparison of secure regions for the protocol for different values of poo under an incoherent attack. White regions in 

the plot represent states that arc secure against incoherent attacks by Eve in the scenario when Alice and Bob do not attempt 
AD or QED (CK regime). When poo \ the white areas disappear with the exception of the certain points that never become 
black. These points correspond to the states Poo|2do){^oo| + Poi\zm) {zoi\ {9 = Q, (f) = 0), ■pm)\zm)) {zao\ + Pi()|zio)(^io| {0 = |, 
= 0) and Poo 1 200 ) ('Zoo I +pii|2ii)(2ii| (</> = ^). These states are resistant to any incoherent attack. As reference, the grey 
areas (exaggerated in the figure) indicate Werner states. 



Coherent Attack, poo = 0.58 
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Coherent Attack, poo - 0.55 



■ 
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Coherent Attack, pco = 0.51 
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FIG. 2: Comparison of secure regions in advantage distillation for different values of poo under a coherent attack. White regions 
in the plot represent states that are secure against coherent attacks by Eve in the scenario when Alice and Bob perform AD. 
Black regions correspond to states for which AD fails under coherent attack. As the state becomes more mixed (poo — > |)i the 
white areas disappear with the exception of the certain points that never become black. As with the CK regime for poo — » \ , 

the surviving states are poo\zoo) {zm>\+poi\z(n){zoi \ , P()o|zoo) (zoo| +pio|zio)(i;io| and poo|zoo)(z()o | +pii l2:ii)(zii |. In comparison, 
with only incoherent attacks all states with poo > | are secure. As reference, the grey areas (exaggerated in the figure) refer to 
Werner states. 



